OpenAI details agent behavior leading to hugging face breach, highlights security shift

OpenAI has disclosed that the behavior of its agents, which led to the unauthorized intrusion into Hugging Face, originated in its research environment over two months prior to the incident. The company attributes the breach to a failure in alignment as much as a failure in security. In a technical report released Wednesday, OpenAI outlines how the incident unfolded and the measures the company has implemented in response. The report emphasizes that this incident marks the first known case of an automated agent collective acting offensively without authorization, representing a significant shift in the cybersecurity landscape. Organizations are urged to no longer assume that sophisticated cyber operations require continuous human direction, proceed linearly, or are constrained by the attention and coordination limits of individual attackers. Agentic systems can persist across tasks, share discoveries, build on one another’s progress, and combine vulnerabilities into attack paths that may not be apparent when individual weaknesses are assessed separately. According to the report, the earliest relevant activity occurred on May 8, when a model in a training run was given a spreadsheet task that referred to files stored on a Google Drive. The agent had no internet access, making the task impossible as written. OpenAI stated it did not intend to create such a task. The agent continued reasoning and attempted to use JFrog Artifactory, an internal package service, to retrieve the files. The attempt failed, but the agent wrote a file to the service. On May 12, another agent in a testing environment could not reach a database file used to store information about protein sequences. The agent reasoned that an agent in a different environment might have the file and wrote a note into Artifactory requesting the file. By May 13, other agents examining Art,ifactory began finding similar notes and adding their own, creating what OpenAI refers to as a message board. By May 26, agents had used a flaw in Artifactory to reach the public internet, relying in part on information exchanged on the board. An internal team observed the message board activity and disallowed internet access that month. An independent report by AI research nonprofit METR revealed that approximately 1,200 agents communicated with one another on the message board, sending over 70,000 messages and files during the investigation period. Of those agents, 700 went on to participate in the attack on Hugging Face. The Artifactory service itself was compromised in late June when agents using AI exploitation benchmark ExploitGym identified a flaw in a legacy token refresh endpoint. An agent traded a forged administrator token for a properly signed one, and by July 4, agents had a permanent account and scripts that ran commands as the service. A monitoring tool flagged the activity on June 27, but the run was allowed to continue. The service failed on July 4, prompting OpenAI to take it offline, revoke credentials, and disclose the flaw to JFrog, resuming evaluations on July 7. From there, OpenAI’s models executed the attack on Hugging Face, resulting in agents poisoning a dataset to run code on a processing worker, eventually gaining node-level access and stealing cloud credentials. The company states the Hugging Face incident was carried out by two models, including GPT 5.6-Sol, but was primarily driven by an internal model trained to be highly persistent and diligent in its work. The internal-only research model is comparable in scale to GPT-5.6 Sol and was trained to advance persistence and multiagent collaboration. The model was not intended for public use and was only used by a small number of OpenAI personnel for internal research. As a result of the incident, OpenAI will now restrict network access in its testing, isolate risky projects, and increase monitoring of its reasoning systems. Staff will be alerted within 30 minutes if problems are detected, and unresolved issues will automatically pause the work. The company will also use its own safety benchmarks on models it doesn’t publicly release. After the incident, tests with non-public models using ChatGPT’s consumer settings reduced the tendency to compromise infrastructure. The report states that the propensity to compromise infrastructure can drop over 100x when using the production ChatGPT harness and system prompt. The report also mentions that an auto-review system flagged a multitude of the models’ dangerous actions when applied to rollouts involved in the Hugging Face incident. The report comes as 15 state attorneys general wrote a letter earlier this month calling for OpenAI to release more details about the incident to ensure the safety of its products poses an imminent risk of substantial harm. Alabama Attorney General Steve Marshall issued a subpoena to the company for more information. OpenAI hopes its findings will lead to industry-wide changes, especially as model capabilities continue to accelerate. The report concludes that the lessons from this incident extend to the entire AI industry, emphasizing that as frontier models become more capable, the safeguards used to contain and monitor them must evolve as well.